---
title: "Widening the Gap: Exploiting LLM Quantization via Outlier Injection"
canonical_url: "https://www.modelscope.cn/papers/281337"
md_url: "https://www.modelscope.cn/papers/281337.md"
arxiv_id: 2605.15152
published: 2026-06-03
last_updated: 2026-06-03
authors:
  - "Xiaohua Zhan"
  - "Kazuki Egashira"
  - "Robin Staab"
  - "Mark Vero"
  - "Martin Vechev"
model_name: "Outlier Injection Attack (OIA)"
model_developer: "ETH Zurich"
domain:
  - "机器学习"
  - "人工智能"
  - "大语言模型安全"
  - "模型量化"
  - "对抗攻击"
type:
  - "机器学习"
  - "人工智能"
  - "大语言模型安全"
  - "模型量化"
  - "对抗攻击"
  - "Machine Learning"
  - "Artificial Intelligence"
arxiv_url: "https://arxiv.org/abs/2605.15152"
pdf_url: "https://arxiv.org/pdf/2605.15152"
code_link: "https://github.com/eth-sri/aio-quantization-attack"
---

# Widening the Gap: Exploiting LLM Quantization via Outlier Injection

> LLM quantization has become essential for memory-efficient deployment. Recent work has shown that quantization schemes can pose critical security risks: an adversary may release a model that appears benign in full precision but exhibits malicious behavior…

「Widening the Gap: Exploiting LLM Quantization via Outlier Injection」是 ModelScope 魔搭社区收录的论文，arXiv 2605.15152，作者为 Xiaohua Zhan, Kazuki Egashira, Robin Staab et al.，发表于 2026-06-03，属于 机器学习、人工智能、大语言模型安全 领域。

- **ArXiv**: 2605.15152
- **Published**: 2026-06-03
- **Authors**: Xiaohua Zhan, Kazuki Egashira, Robin Staab, Mark Vero, Martin Vechev
- **Model**: Outlier Injection Attack (OIA)
- **Developer**: ETH Zurich
- **Domain**: 机器学习, 人工智能, 大语言模型安全, 模型量化, 对抗攻击
- **ArXiv URL**: https://arxiv.org/abs/2605.15152
- **PDF**: https://arxiv.org/pdf/2605.15152
- **Code**: https://github.com/eth-sri/aio-quantization-attack

Source: https://www.modelscope.cn/papers/281337

---

> 扩大差距：通过异常值注入利用 LLM 量化漏洞

## 摘要

本文提出了一种针对大语言模型（LLM）量化的新型安全攻击方法。攻击者通过在模型权重中注入特定的异常值，使得模型在全精度下表现正常，但在用户应用常见量化方法（如 GPTQ、AWQ、GGUF 等）后触发恶意行为。该方法利用量化过程中异常值导致非异常值权重被舍入为零的特性，实现跨多种优化型量化方案的通用攻击。实验表明，该攻击在越狱、过度拒绝和内容注入三种场景下均能取得超过95%的攻击成功率，同时保持全精度下的模型效用，且现有基于噪声的防御方法对其无效。

## Abstract

LLM quantization has become essential for memory-efficient deployment. Recent work has shown that quantization schemes can pose critical security risks: an adversary may release a model that appears benign in full precision but exhibits malicious behavior once quantized by users. However, existing quantization-conditioned attacks have been limited to relatively simple quantization methods, where the attacker can estimate weight regions that remain invariant under the target quantization. Notably, prior attacks have consistently failed to compromise more popular and sophisticated schemes, limiting their practical impact. In this work, we introduce the first quantization-conditioned attack that consistently induces malicious behavior that can be triggered by a broad range of advanced quantization techniques, including AWQ, GPTQ, and GGUF I-quants. Our attack exploits a simple property shared by many modern quantization methods: large outliers can cause other weights to be rounded to zero. Consequently, by injecting outliers into specific weight blocks, an adversary can induce a targeted, predictable weight collapse in the model. This effect can be used to craft seemingly benign full-precision models that exhibit a wide range of malicious behaviors after quantization. Through extensive evaluation across three attack scenarios and LLMs, we show that our attack achieves high success rates against a broad range of quantization methods on which prior attacks fail. Our results demonstrate, for the first time, that the security risks of quantization are not restricted to simpler schemes but are broadly relevant across complex, widely-used quantization methods.